import { z } from 'zod';
export declare const semverVersion: z.ZodString;
export declare const permissionDeclaration: z.ZodObject<{
    key: z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">;
    description: z.ZodString;
}, z.core.$strip>;
export type PermissionDeclaration = z.infer<typeof permissionDeclaration>;
export declare const eventTypeRef: z.ZodObject<{
    type: z.ZodString;
    schemaVersion: z.ZodNumber;
}, z.core.$strip>;
export type EventTypeRef = z.infer<typeof eventTypeRef>;
export declare const manifestGuard: z.ZodObject<{
    before: z.ZodString;
    predicate: z.ZodString;
    config: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
}, z.core.$strip>;
export type ManifestGuard = z.infer<typeof manifestGuard>;
export declare const scheduleSpec: z.ZodObject<{
    operation: z.ZodString;
    cadence: z.ZodObject<{
        everyMinutes: z.ZodNumber;
    }, z.core.$strip>;
    input: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
    permissions: z.ZodDefault<z.ZodArray<z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">>>;
}, z.core.$strip>;
export type ScheduleSpec = z.infer<typeof scheduleSpec>;
export declare const freshnessSpec: z.ZodObject<{
    eventType: z.ZodString;
    within: z.ZodObject<{
        hours: z.ZodNumber;
    }, z.core.$strip>;
}, z.core.$strip>;
export type FreshnessSpec = z.infer<typeof freshnessSpec>;
export declare const envVarSpec: z.ZodObject<{
    key: z.ZodString;
    label: z.ZodOptional<z.ZodString>;
    description: z.ZodString;
    placeholder: z.ZodOptional<z.ZodString>;
    required: z.ZodDefault<z.ZodBoolean>;
    secret: z.ZodDefault<z.ZodBoolean>;
    default: z.ZodOptional<z.ZodString>;
    group: z.ZodOptional<z.ZodString>;
}, z.core.$strip>;
export type EnvVarSpec = z.infer<typeof envVarSpec>;
/**
 * A named capability a vertical **provides** or **requires** (e.g. `oidc-issuer`), wired
 * tenant-side through the connection store (marketplace-publish.md §4). Lowercase kebab.
 * Identity is per-tenant, so one provider (an auth-server) serves all a tenant's requiring
 * verticals — the connection binds them, nothing is bundled into a consumer's manifest.
 */
export declare const capability: z.ZodString;
export type Capability = z.infer<typeof capability>;
/** The runtime resolution of an `envSpec` against a raw environment. */
export interface ResolvedEnv {
    /** Each declared key → its value (from `raw`, else the spec's `default`). */
    values: Record<string, string | undefined>;
    /** Declared `required` keys that resolved to nothing — a deploy misconfiguration. */
    missingRequired: string[];
}
/**
 * Resolve a declared `envSpec` against a raw environment (a Worker `env`, `process.env`, …).
 * Reads ONLY the declared keys, so the manifest is the single source of what an app consumes
 * (a key it doesn't declare, it doesn't read); applies each spec `default`; and reports absent
 * `required` keys. Never throws — the caller decides whether a missing required key is fatal
 * (a hosted vertical may have a per-scope fallback), and the config form is where a bad deploy
 * is blocked. Non-string raw values (e.g. a binding) are ignored — the spec covers string config.
 *
 * This reads DEPLOYMENT-WIDE config only: env-spec defaults ride as worker bindings shared by
 * every install of one serving script, so this can never see a per-install override saved in the
 * dashboard Env tab. A hosted vertical that has per-instance settings must use
 * `resolveScopedEnvSpec`, passing the config delivered to that scope.
 */
export declare function resolveEnvSpec(spec: EnvVarSpec[], raw: Record<string, unknown>): ResolvedEnv;
/**
 * Resolve a declared `envSpec` for ONE hosted instance: the deployment environment
 * overlaid with the per-scope config DELIVERED to that instance (the dashboard Env tab →
 * `/internal/configure`). Precedence is **delivered > env > default** — a per-install
 * override wins over the deployment-wide binding (which for a hosted vertical typically
 * just carries the manifest `default:`), which wins over the declared default.
 *
 * This is the read half a hosted vertical needs and `resolveEnvSpec(env)` alone cannot
 * give: env-spec defaults ride as worker bindings, shared by every install of one serving
 * script, so a per-install setting can only arrive through the per-scope delivery channel
 * and MUST be overlaid here — reading `env` alone always yields the shared default (the
 * silent-defaults bug). `delivered` is the vertical's OWN per-scope config map: it owns
 * the store (a DO row set, a table) and reads it back keyed by scope; the platform never
 * sees it. This function is the pure merge over that map, so it stays dependency-free and
 * each vertical supplies `delivered` however it stores config. Only DECLARED keys are read
 * (the manifest stays the allow-list — a stray delivered key never reaches the app), an
 * empty/absent delivered value is not an override (keeps env/default, matching
 * `resolveEnvSpec`), and `missingRequired` reflects the overlaid values.
 */
export declare function resolveScopedEnvSpec(spec: EnvVarSpec[], raw: Record<string, unknown>, delivered: Record<string, string | undefined>): ResolvedEnv;
export declare const moduleManifest: z.ZodObject<{
    id: z.core.$ZodBranded<z.ZodString, "ModuleId", "out">;
    version: z.ZodString;
    kernelContract: z.ZodString;
    permissions: z.ZodArray<z.ZodObject<{
        key: z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">;
        description: z.ZodString;
    }, z.core.$strip>>;
    events: z.ZodObject<{
        emits: z.ZodArray<z.ZodObject<{
            type: z.ZodString;
            schemaVersion: z.ZodNumber;
        }, z.core.$strip>>;
        consumes: z.ZodArray<z.ZodObject<{
            type: z.ZodString;
            schemaVersion: z.ZodNumber;
        }, z.core.$strip>>;
    }, z.core.$strip>;
    migrations: z.ZodObject<{
        journalDir: z.ZodString;
        compatibleFrom: z.ZodString;
    }, z.core.$strip>;
    attachmentTargets: z.ZodArray<z.ZodObject<{
        entityType: z.ZodString;
        readPermission: z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">;
        writePermission: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">>;
    }, z.core.$strip>>;
    liveTargets: z.ZodOptional<z.ZodArray<z.ZodObject<{
        entityType: z.ZodString;
        readPermission: z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">;
    }, z.core.$strip>>>;
    entityRelations: z.ZodOptional<z.ZodArray<z.ZodObject<{
        entityType: z.ZodString;
        parentType: z.ZodString;
    }, z.core.$strip>>>;
    guards: z.ZodOptional<z.ZodArray<z.ZodObject<{
        before: z.ZodString;
        predicate: z.ZodString;
        config: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
    }, z.core.$strip>>>;
    schedules: z.ZodOptional<z.ZodArray<z.ZodObject<{
        operation: z.ZodString;
        cadence: z.ZodObject<{
            everyMinutes: z.ZodNumber;
        }, z.core.$strip>;
        input: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
        permissions: z.ZodDefault<z.ZodArray<z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">>>;
    }, z.core.$strip>>>;
    freshness: z.ZodOptional<z.ZodArray<z.ZodObject<{
        eventType: z.ZodString;
        within: z.ZodObject<{
            hours: z.ZodNumber;
        }, z.core.$strip>;
    }, z.core.$strip>>>;
    withdraws: z.ZodOptional<z.ZodArray<z.ZodString>>;
    entitlementKey: z.ZodString;
    envSpec: z.ZodOptional<z.ZodArray<z.ZodObject<{
        key: z.ZodString;
        label: z.ZodOptional<z.ZodString>;
        description: z.ZodString;
        placeholder: z.ZodOptional<z.ZodString>;
        required: z.ZodDefault<z.ZodBoolean>;
        secret: z.ZodDefault<z.ZodBoolean>;
        default: z.ZodOptional<z.ZodString>;
        group: z.ZodOptional<z.ZodString>;
    }, z.core.$strip>>>;
    ownerGrants: z.ZodOptional<z.ZodArray<z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">>>;
    entitlements: z.ZodOptional<z.ZodArray<z.ZodString>>;
    provides: z.ZodOptional<z.ZodArray<z.ZodString>>;
    requires: z.ZodOptional<z.ZodArray<z.ZodString>>;
    api: z.ZodOptional<z.ZodString>;
    searchables: z.ZodOptional<z.ZodArray<z.ZodObject<{
        entityType: z.ZodString;
        fields: z.ZodArray<z.ZodString>;
        table: z.ZodOptional<z.ZodString>;
        idColumn: z.ZodOptional<z.ZodString>;
        tokenizer: z.ZodOptional<z.ZodEnum<{
            prefix: "prefix";
            substring: "substring";
        }>>;
    }, z.core.$strip>>>;
    lists: z.ZodOptional<z.ZodArray<z.ZodObject<{
        entityType: z.ZodString;
        sortable: z.ZodArray<z.ZodString>;
        filterable: z.ZodOptional<z.ZodArray<z.ZodString>>;
        table: z.ZodOptional<z.ZodString>;
        idColumn: z.ZodOptional<z.ZodString>;
    }, z.core.$strip>>>;
    ui: z.ZodOptional<z.ZodObject<{
        routes: z.ZodOptional<z.ZodArray<z.ZodObject<{
            path: z.ZodString;
            screen: z.ZodString;
            permission: z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">;
        }, z.core.$strip>>>;
        nav: z.ZodOptional<z.ZodArray<z.ZodObject<{
            label: z.ZodString;
            icon: z.ZodOptional<z.ZodString>;
            to: z.ZodString;
            permission: z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">;
        }, z.core.$strip>>>;
        entityViews: z.ZodOptional<z.ZodArray<z.ZodObject<{
            entityType: z.ZodString;
            view: z.ZodString;
        }, z.core.$strip>>>;
        widgets: z.ZodOptional<z.ZodArray<z.ZodObject<{
            slot: z.ZodString;
            component: z.ZodString;
            permission: z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">;
        }, z.core.$strip>>>;
        settingsPanels: z.ZodOptional<z.ZodArray<z.ZodObject<{
            label: z.ZodString;
            component: z.ZodString;
            permission: z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">;
        }, z.core.$strip>>>;
    }, z.core.$strip>>;
}, z.core.$strip>;
export type ModuleManifest = z.infer<typeof moduleManifest>;
//# sourceMappingURL=manifest.d.ts.map